Security readout for executives and security teams
Plain-English summary
Cloud Foundry UAA could write client secrets into logs when DEBUG logging is enabled and secrets are sent in URL query parameters. If an authenticated attacker can reach those logs, they may recover credentials and use them to access protected systems.
Executive priority
Treat this as a high-priority credential exposure issue where vulnerable configuration exists. The main business risk is stolen application credentials from logs, potentially enabling unauthorized access beyond the UAA server itself.
Technical view
CVE-2019-11293 affects Cloud Foundry UAA Release versions prior to v74.10.0. With DEBUG logging, UAA logs all query parameters, including client_secret values used in query-parameter authentication. The CVSS 3.0 score is 8.8, mapped to CWE-532 for insertion of sensitive information into log files.
Likely exposure
Exposure is most likely in Cloud Foundry environments running UAA before v74.10.0, with DEBUG logging enabled, clients sending client_secret in query parameters, and readable uaa.log files or log aggregation access.
Exploitation context
The source bundle does not show KEV listing or active exploitation. The CVSS vector indicates network access, low attack complexity, low privileges, and no user interaction. Practical impact depends on whether secrets entered UAA logs and who could read them.
Researcher notes
Evidence is clear on product, version boundary, condition, and sensitive logging behavior. The bundle does not provide exploit examples, active exploitation evidence, or detailed vendor remediation beyond the v74.10.0 boundary.
Mitigation direction
- Upgrade Cloud Foundry UAA Release to v74.10.0 or later.
- Disable DEBUG logging unless explicitly required for short troubleshooting windows.
- Avoid sending client_secret values in query parameters.
- Restrict access to uaa.log and centralized log stores.
- Follow Cloud Foundry guidance for any secret rotation decisions.
Validation and detection
- Confirm the deployed UAA Release version is earlier than v74.10.0.
- Check whether UAA logging is or was set to DEBUG.
- Identify clients that authenticate using client_secret query parameters.
- Review uaa.log and log aggregation access permissions.
- Assess whether exposed client secrets require rotation.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-532: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2019-11293 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.8 (3.0)
- Known Exploited
- No
- Published
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H2.85.9Primary CVE scoreVulnerability scoring details
Base CVSS 3.0 score
8.8HighVector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://www.cloudfoundry.org/blog/cve-2019-11293CVE reference · x_refsource_CONFIRM
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Insertion of Sensitive Information into Log File
Insertion of Sensitive Information into Log File represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.